Data access and deletion
Email [email protected] from the address the data relates to and say whether you want a copy, a correction or deletion. We acknowledge within five business days and complete the request within thirty days, at no cost.
What you can ask for
- Access
- A copy of the personal information we hold about you, in a machine-readable format.
- Correction
- Anything inaccurate, out of date, incomplete or misleading, corrected.
- Deletion
- Erasure of your personal information, except where we are legally required to keep a record.
- Explanation
- What we hold, why we hold it, where it came from and who else has seen it.
How to make a request
- Email [email protected] from the email address the data relates to.
- Say which of the four things above you want.
- If you cannot email from that address, tell us and we will agree another way to verify it is you. We ask only for what is needed to be sure, and we delete the verification material afterwards.
Timelines
| Step | When |
|---|---|
| Acknowledgement | Within 5 business days |
| Completion | Within 30 days |
| Cost | None |
| If we refuse | Written reasons, and how to complain |
Retention
- Contact form messages
- Kept while the enquiry is open, then 24 months, then deleted.
- Recruitment applications
- Kept 12 months from submission unless you ask us to keep them longer, then deleted.
- Bounty submissions
- Kept while the finding is open, then retained as a security record for 24 months.
- First-party analytics
- Event rows kept 14 months, then deleted. Aggregates are kept indefinitely and contain no identifiers.
- Edge and security logs
- Kept 30 days, then deleted. Retained longer only where a specific incident is under investigation.
- Account records
- Kept while the account exists, then deleted within 30 days of closure.
If you are not satisfied
Tell us first — most complaints are a misunderstanding we can fix quickly. Write to [email protected] and mark it a complaint; we respond in writing within 30 days.
If you are still not satisfied, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au. You do not need our permission to do that, and using our process first is not a precondition.
Australian Privacy Principles
We handle personal information in line with the Australian Privacy Principles under the Privacy Act 1988 regardless of turnover thresholds, because deciding which customers deserve the protections is not a decision worth having.
That means: we collect only what we need, we say why at the point of collection, we do not use it for something unrelated later, we keep it secure, and we give it back or delete it when you ask.
Related
Sources
Where this page states a standard, an obligation or a research result, this is what it is drawn from. All external, all checkable.
- Privacy Act 1988 (Cth) — the Act itself, current compilation
- Australian Privacy Principles — OAIC, the regulator
- Making a privacy complaint — OAIC — the escalation path if we get it wrong
- Notifiable Data Breaches scheme — OAIC
- Global Privacy Control — the specification our analytics honours
Last reviewed · Site changelog